Highline Public Schools ransomware attack

Analyst assessment

Highline Public Schools experienced a confirmed ransomware incident that disrupted district operations after unauthorized activity was detected Sept. 7, 2024. Its Oct. 3 investigation update explicitly identified ransomware. The earlier Sept. 8 public announcement, reproduced in local reporting, already described unauthorized activity and protective isolation of critical systems. Cyber disclosure therefore predates the later ransomware label.

The district’s April 2, 2025, notice confirmed that an unknown actor accessed network systems and files containing personal information. It listed possible identifiers, financial, health, employment and student information, varying by individual. That finding establishes unauthorized access; it does not by itself demonstrate that records were downloaded, published or used for fraud.

Operational significance

School closures lasted Sept. 9–11, with classes reopening Sept. 12 under manual operating arrangements. Reopening did not end the technology disruption. The district’s retrospective account describes approximately six weeks of disruption, critical-system restoration on Oct. 21 and a device-reimaging backlog still present on that date. Attendance, student information, transportation routing and internal administration required workarounds.

A Sept. 19 district update documented restricted access to classroom tools and intermittent phone service while Office 365 email, the website and ParentSquare remained available. The incident FAQs also explain that central heating controls were unavailable at most schools, but local manual controls kept heat functioning. This was an operational technology limitation, rather than evidence that school buildings lost heat.

The settlement agreement in Solis v. Highline School District No. 401 describes a $650,000 fund and a settlement class of about 94,102 people following the September 2024 incident. Highline denies wrongdoing and liability. The settlement administrator’s website lists an April 20, 2026, claims deadline and an April 24 final approval hearing. Those scheduled dates do not establish that the court granted final approval or that payments were made. The settlement class is distinct from a verified count of records stolen.

Confidence and uncertainty

Confidence is high that malicious activity caused substantial educational and administrative disruption. Ransomware confidence is high because the district identified it after forensic investigation. Attribution remains unresolved: the official notice names an unknown actor, and native searches of the district name, domain and supported district alias returned no claim. The reviewed evidence does not establish a ransom demand, payment or refusal.

Recovery was staged. October FAQ updates describe tools returning as devices were reimaged and passwords reset, while more services remained to be opened. Reimaging also removed desktop-stored files, although cloud files remained available. That loss occurred during recovery and should not be presented as proof that an attacker deliberately destroyed those files. Neither password resets nor the recovery program identifies the original access method.

Analytic gaps

The initial intrusion date, access technique, malware family, compromised hosts, encryption extent and any data exfiltration remain unverified. Sept. 7 is the supported discovery and isolation date, rather than a proven first-access date. The original Sept. 8 announcement URL is no longer available, but contemporaneous reproduction and the district’s retrospective chronology corroborate its date and wording.

Oct. 21 is the latest supported operational-impact observation, including the remaining device work. Critical services were reported restored, but the record does not establish a universal restoration day or exact end to every limitation. The incident is presumed resolved based on elapsed time, with no exact end date asserted. The later privacy investigation and monitoring notices do not indicate that school-service outages continued into 2025.